Cookie consent is the permission your visitors give before non-essential cookies are stored on their device. It is a legal requirement, not a piece of software. A consent management platform (CMP) is the software that collects that permission, enforces it in the browser, and keeps the records that prove it existed. One is an obligation; the other is the machinery built to meet it.
The two terms get used interchangeably, and the confusion has a cost. Plenty of websites bought a banner, called the job done, and then collected fines because the scripts underneath ignored what the banner promised.
Cookie consent is the legal layer: Article 5(3) of the ePrivacy Directive requires permission before non-essential cookies are set, and the General Data Protection Regulation (GDPR) defines what that permission must look like.
A CMP is the tooling layer: consent banner, cookie scanner, script blocking, region-specific rules, and timestamped consent records in one system.
A banner alone rarely satisfies the law. A 2025 study of 254,148 websites found that 67% showed a consent interface but only 15% passed a minimal compliance test.
France's data protection authority, the CNIL, issued 83 sanctions worth EUR 486.8 million in 2025, and its cookie cases targeted what happened behind the banner: trackers firing before, despite, or after the visitor's choice.
Since 16 January 2024, Google has required a certified CMP for personalised ads in the European Economic Area (EEA) and the UK, which makes the CMP a formally certified product category rather than a marketing label.
What Does Cookie Consent Actually Mean?
Cookie consent is the freely given, specific, informed, and unambiguous permission a visitor grants before a website stores or reads non-essential cookies on their device. It is something your visitor does, and something the law obliges you to obtain first. No product purchase changes that definition.
The obligation comes from Article 5(3) of the ePrivacy Directive (Directive 2002/58/EC), which requires consent before anything is stored on or read from a user's device unless it is strictly necessary for a service the user explicitly requested. The GDPR then supplies the consent standard itself: it must be a clear affirmative act, given per purpose, refusable without detriment, and withdrawable as easily as it was given. Pre-ticked boxes do not count. Neither does scrolling.
Notice what is absent from both instruments: any mention of software. The GDPR cookie consent requirements describe an outcome, not a product. That distinction is the whole subject of this article, and it explains why cookie consent can exist without any platform at all, at least on paper.
What Is a Consent Management Platform?
A consent management platform is software that displays a consent banner, detects the cookies a site actually sets, blocks non-exempt scripts until permission is given, applies different rules by visitor region, and stores a timestamped record of every choice. The banner is the only part a visitor ever sees; the other four components are the point.
A working CMP runs a cookie scanner against your pages on a schedule, because the tags on a live website change every time marketing adds a pixel or a developer drops in a new library. It holds analytics and advertising scripts back until the visitor decides, releases them per category once consent arrives, and reverses that release when consent is withdrawn. Each decision lands in a log with a timestamp, the banner version shown, and the categories chosen.
That last part matters more than most buyers realise. Consent you cannot evidence is consent you cannot rely on when a regulator writes to you.
How Do the Two Compare?
The cleanest way to separate the concepts is side by side, and one pattern repeats down every row: the left column describes a legal state, the right column describes machinery.
| Aspect | Cookie consent | Consent management platform |
|---|---|---|
| What it is | A legal requirement and a visitor's decision | A software product |
| Where it comes from | Article 5(3) ePrivacy Directive and the GDPR consent standard | A vendor's feature set |
| Visible form | The choice a visitor makes on a banner | Banner plus scanner, script blocking, geo-rules, and consent logs |
| What it produces | Permission or refusal | Enforcement of that choice in the browser, and proof it happened |
| Can it exist without the other | Yes, any mechanism that meets the legal test will do | No, it exists to operationalise the requirement |
| Who checks it | Data protection authorities (DPAs) | Certification programmes, and DPAs indirectly |
Read the table backwards and the relationship becomes obvious. You cannot buy cookie consent, because only your visitors can give it; you can buy a CMP, because collecting, enforcing, and proving consent at scale is an engineering problem, and engineering problems have products.
Can You Have Cookie Consent Without a CMP?
Legally, yes. Article 5(3) demands valid consent before non-essential cookies fire; it does not demand any particular tool. A hand-built banner wired to conditional script loading can satisfy the law if it genuinely blocks everything non-exempt until the visitor agrees, honours refusal, and supports withdrawal.
In practice, three things go wrong with the do-it-yourself route. Tag managers and third-party embeds fire before custom blocking code catches them. Withdrawal gets built as a preference toggle that updates a value but never stops the scripts already running. And nothing writes a consent record, so there is no evidence trail when questions arrive. Each failure is invisible on the page. All three are visible in an audit.
The scale of that gap is measurable. A study presented at the CHI 2025 conference analysed 254,148 websites across 31 European countries and found that 67% displayed some form of consent interface, yet only 15% met a minimal compliance test, most often because rejecting was harder than accepting. Two-thirds of the web has cookie consent in the sense of owning a banner. A sixth of it has cookie consent in the sense the law recognises.
Where Does the Gap Turn Into Fines?
Enforcement lands on the gap between what a banner says and what the site underneath does. As of August 2026, the CNIL's published summary of its 2025 activity reports 83 sanctions totalling EUR 486.8 million, with cookies among the main subjects, and 21 entities sanctioned specifically over trackers. The recurring breaches were storage without consent, information too thin for consent to count as informed, and failure to act on refusal or withdrawal.
The headline cases follow the same pattern. In September 2025 the CNIL fined Google EUR 325 million, partly for placing cookies during account creation without valid consent, and fined Shein's operating company EUR 150 million after finding advertising trackers deposited the moment users landed, before any choice was made. Both sites showed consent interfaces. The cookie consent fines of the past two years were mostly issued to organisations that had banners, not to organisations that lacked them.
There is a quieter risk behind the headline numbers: under Article 7(1) of the GDPR, the burden of demonstrating consent sits with you, not the regulator. When a DPA asks who consented to what and when, a screenshot of your banner answers nothing; only records do. Whether a given consent flow produces valid consent is a separate question from whether you can prove it did, and an investigation tests both.
When Is a CMP Effectively Mandatory?
No privacy law names the CMP as compulsory. Google does. Since 16 January 2024, publishers serving personalised ads to visitors in the EEA or the UK through AdSense, Ad Manager, or AdMob have been required to use a Google-certified CMP integrated with the Interactive Advertising Bureau's Transparency and Consent Framework (IAB TCF). Switzerland joined the requirement on 31 July 2024. Without one, personalised ad serving to those regions stops, and so does most of the revenue attached to it.
The same consolidation shows up on the measurement side. Google Consent Mode v2 became a condition for audience and remarketing features across Google's advertising stack in March 2024, and it needs a consent signal to relay, which in practice means a CMP sending it. Certification lists are public, so checking whether a vendor is a Google-certified CMP takes a minute and removes the guesswork.
For ad-funded sites, the terminology question is settled commercially rather than legally. The obligation is still cookie consent; the certified CMP is now the only accepted way to feed it into the ad ecosystem.
Which One Do You Actually Need?
Both, in the only combination that works: consent from your visitors, management from your tooling. If your site sets nothing beyond strictly necessary cookies, you need neither a banner nor a platform. The moment analytics, advertising, or embedded media enter the picture for European or UK visitors, you need prior consent, per-category blocking, withdrawal that actually stops scripts, and records, and at that point you are describing a CMP whether you build it or buy it.
Evaluating vendors is its own exercise. A structured CMP comparison checklist covering scanning, blocking, geo-rules, logging, and certification status separates working machinery from a banner with a settings page.
Frequently Asked Questions
Is a cookie banner the same as a consent management platform?
No. The banner is the visible interface where a visitor makes a choice. A CMP includes the banner plus cookie scanning, script blocking, regional rules, and consent records, and those invisible parts do the compliance work.
Do I need a consent management platform for a small website?
If the site only sets strictly necessary cookies, no consent and no platform are needed. Once analytics or marketing tags run for EU or UK visitors, prior blocking and consent records become obligations that are hard to meet by hand, and a CMP is the practical answer.
Can you be GDPR compliant without a CMP?
Yes, in principle. The law requires valid, provable consent, not any specific product. In practice you would need to replicate script blocking, withdrawal handling, and timestamped record-keeping yourself, which is exactly the work a CMP packages.
Why does Google require a certified CMP for publishers?
Google needs standardised, machine-readable consent signals to pass through its ad systems. Since 16 January 2024, serving personalised ads to EEA and UK visitors through AdSense, Ad Manager, or AdMob has required a Google-certified CMP integrated with the IAB TCF.
What happens if a website has a banner but cookies load anyway?
The consent collected is invalid, because the choice was not honoured. This is the exact breach pattern behind most recent cookie fines, including the CNIL's 2025 decisions, where trackers fired before, despite, or after the visitor's choice.
Put Working Machinery Behind Your Banner
If your site shows a banner but you have never checked what fires underneath it, that gap is where the risk lives. Kukie.io scans your cookies, blocks non-exempt scripts until consent is given, and keeps a timestamped record of every choice.
